align dev tooling with youngstartup conventions

require-dev: phpstan ^2.1 + strict rules, larastan ^3, php-cs-fixer
^3.91 + jubeki/laravel-code-style ^2.18, ide-helper ^3.7. add
phpstan.neon (level max, app/ scope) and .php-cs-fixer.dist.php
(jubeki preset, modifier_keywords rule). phpunit.xml mirrors
youngstartup (sqlite :memory:, bcrypt rounds 4, enforceTimeLimit).
gitignore picks up _ide_helper.php, *~, .php-cs-fixer.cache. drop
sail's phpactor.json line. composer scripts: drop npm bits from
setup/dev (frontend lives separately). composer test + stan +
cs:check all green on default scaffold.

backend/.php-cs-fixer.dist.php

@@ -0,0 +1,23 @@
+<?php
+
+require __DIR__.'/vendor/autoload.php';
+require __DIR__.'/bootstrap/app.php';
+
+return (new Jubeki\LaravelCodeStyle\Config())
+    ->setFinder(
+        PhpCsFixer\Finder::create()
+            ->notName('*.blade.php')
+            ->in(app_path())
+            ->in(config_path())
+            ->in(database_path('factories'))
+            ->in(database_path('migrations'))
+            ->in(database_path('seeders'))
+            ->notPath(base_path('vendor'))
+            ->in(base_path('routes'))
+            ->in(base_path('tests'))
+    )
+    ->setRules([
+        'modifier_keywords' => [
+            'elements' => ['method', 'property'],
+        ],
+    ]);